Thoughts from a Conservative point of view in regards to technology

Menu

Post navigation

Overview

Symantec Endpoint Prevent for DLP has the ability to track and limit data being copied to removable storage (USB drives, etc.). Within a DLP policy we can leverage the DeviceID of a removable storage device as either an inclusion or exclusion to our policy. This document will cover how to set it up.

Process

The first tool we need to leverage is “DeviceID.exe” which is a part of the Tools folder under the DLP agent source directory. This executable will allow us to gather both the Device ID and the Regex that is needed for either the exclusion or inclusion.

This information is taken from the Help file for DLP and the DLP Admin Guide.

Connect the USB Device to your computer

From the command prompt navigate to the folder where the “Tools” directory is located

Execute “DeviceID.exe” to get a list of the devices attached to your computer

There are two values displayed per device connected to your laptop/desktop

Dev ID: Contains the full string for the device connected to your laptop

Regex: The value we want to put in our exclusion or inclusion

NOTE: If you have a large amount of devices attached to your laptop or desktop the output can be directed to a text file via “DeviceID.exe > textfile.txt”

Open up the DLP Console and navigate to System -> Agents -> Endpoint Devices

Select “Add Device” and fill out the form

Note: Use the Regex value from DeviceID to fill out the device definition portion of things

NOTE: The goal is to be both as generic and specific as possible to make sure there is not a giant list of device ids

Leveraging the DeviceID in a DLP Policy

Once the DeviceID is created it can be used as either an exclusion or an inclusion within the policy

Login to the DLP Console

Navigate to Policy Portion (Policy -> Policy List)

Edit (or create) the policy you would like to use this in

Select “Add Exception”

Towards the bottom of the Exception Type is “Endpoint Device Class or ID”

Select this option and select “Next”

Select the DeviceID you would like to use for an exclusion and select next

Select “OK” to save your exception

NOTE: This same process can be used to create an inclusion in your DLP Policy as well

Overview

In version 14 of their DLP product Symantec introduced the ability to scan corporate Box.com accounts via Network Discover to see what confidential data is stored within an organization’s Box.com environment. In Data Insight 5.0 we now have the ability to process Box.com to understand the context of the files in our Box.com account.

This guide will cover configuring Box.com scanning and then also provide some screenshots around what it looks like.

How it works

After logging into the Data Insight Console we will need to access the Settings tab of the Management Console to setup our “Cloud Sources” which can be found on the left side of the Console.

In the above screenshot (Figure 1) it shows there is one Cloud Service enabled and we would like to add an additional source by clicking on “Add a new cloud service.” (While I have not seen an official roadmap, I would assume additional services are forthcoming.)

In order to perform the scanning, we will need to authorize the account against the Box.com API

In order to process everything correctly, make sure the owner account is used to connect and use the system. The above screenshot (Figure 3) shows the demo system being authenticated to the system.
One the indexer and collecter are assigned, we can then start the scanning of the Box.com account.

Examples

Now that the Cloud Source is configured we can start the Data Insight scan (or wait for the normal schedule). In the below figure (Figure 4) we have clicked on the “Actions” drop down and have selected “Scan Now.”

Once the scan has been completed and the information has been processed, Box.com information will be in the Data Insight system.

The problem:

Recently I was installing the stand-alone version of IT Analytics and the DLP Cubes and kept running into problems processing the cubes in regards to invalid username and password. When the cubes were processed within IT Analytics a large error was created but the full text was not generated. So I jumped in SQL Management Studio, connected to the Analysis Services, found my DLP Cubes and tried to process them. It was within SQL Management Studio and found I was getting an error with invalid username and password.

This error message confused me as I was using the same account that I installed SQL with and installed IT Analytics with. So I tried some troubleshooting and checked various roles within SQL and checked what permissions were set on the Database, Analysis Services, etc.
And it was time to panic, I had a demo today at a new to me customer and needed to have strong showing…. So it was off to Symantec Support to try and resolve the problem. I had great success getting my incident resolved at 3:26pm EST when my demo started at 3:30pm EST.

So here’s the solution

The solution to my problem:

The first part that was wrong with my installation and configuration was I did not read the installation manual all the way to the end and missed a step. Also there was another step that needed to be changed.

NOTE: After making these changes you will need to restart your SQL Server Services to make sure everything is updated and fixed correctly.

Changes made to the provider

This first step is documented in the install guide and I just did not read all the way through it. The OraOLEDB.Oracle provider needs to have a setting changed in order for the processing to work. We need to select “Allow inprocess” in order for the cubes to process correctly.

In SQL Management Studio, connect to the Database portion of your server and then we need to find the list of providers. This is found under “Server Objects -> Linked Servers -> Providers and then right click on the OraOLEDB.Oracle provider and select properties.

As shown in the screenshot, we need to select “Allow inprocess.” Check this box and select “OK”

Changes made to the Data Source

The next change that needs to be made to the ITAnalytics Data Source. This setting is found under the Analysis Server portion of your SQL Server. If you already closed Management Studio, you will need to reopen it up and connect to the Analysis Server, if it is still open connect to the Analysis Server. Under Databases find the ITAnalytics Database and expand “Data Sources” where you will find a listing for the “ITAnalytics” Data Source. Right-click and select properties and you should see something that looks like the following screenshot

What we will change is the “Security Settings from “Default” to the service account we are using for IT Analytics. When you click on the “…” a new window will open up, select “Use a specific Windows user name and password” and provide the correct information. My system looks like the following screenshot

One of the concerns in the past for using IT Analytics has been the requirement for a Symantec Management Platform (SMP also known as Altiris) to be configured first before you install and manage the cubes. This is no loner the case as there is a stand-alone version of IT Analytics available (this will be covered in a separate blog post). This post will cover why you should be using IT Analytics for your DLP system.

Why IT Analytics for Symantec DLP

Within the Symantec DLP console there are a bunch of ways to slice and dice the data that is generated in the system (Incidents, etc.) either by filtering the data or by creating various summarizations of the data. IT Analytics adds several items that are not exposed without having to write a SQL query or leverage the API. IT Analytics allows for someone who does not have access to the DLP console to run reports against the information. Also IT Analytics can easily create trending reports to demonstrate how risk is being reduced over time.

Whenever people ask me why I should bother with IT Analytics there are two reports that I point to that demonstrate the value of IT Analytics.

User Login Report

User Action Auditing Report

The first screenshot (User Login Report) shows which users have logged into the DLP system and the second report (User Action Auditing Report) shows who has changed what policies in the DLP system. These two reports are requested over and over by customers. How can I prove to my auditors or management that no one is changing a DLP policy randomly? This information is coming out of the Oracle Database but without ITA you would have to write a SQL statement and then clean it up to provide auditors or management.

Incident Trend By Product Area

A third common request is “how can I show trends” in my DLP system and the above screenshot shows this trend.

Finally IT Analytics provides Key Performance Indicators (both predefined or custom created) demonstrate how your Symantec DLP system is reducing risk over time and how the system is performing.

How do I get IT Analytics?

IT Analytics is provided free of charge however a license key and the MSI is needed before you can install ITA.. If you have Symantec Endpoint Protection in your environment the MSI for performing the installation is located on the Tools portion of the media. However if you are not a SEP customer, please contact either your Symantec Account Manager or Bay Dynamics. NOTE: MY company (ITS Partners) can help you obtain the license

Recently I was doing an install of Symantec DLP on a Red Hat Linux box that was a member of LDAP and had the /home folder automounted and didn’t allow for us to write to that folder. When a new local user was created via the adduser command it would not work without passing a command line option to change the location of the home directory (adduser -b /opt/users/).

During the install of Symantec DLP, the installer creates a user (protect, protect_update) and would fail because the home directory (/home/protect) could not be created.

So the question was asked… Can we create a user, populate the home directory outside of /home and then perform the install of the system?

Answer: No… The installer for Symantec DLP needs to create the correct users and must be able to write /home when creating the user. There is currently an enhancement request within Symantec to allow a pre-created account.